TK1951 crashed in 2009 in Amsterdam when the computers idled the
engines while still 350 feet in the air, killing 9 including the pilots.
The report focuses on the pilots and the radar altimeters as the faults.
The final report is available here (228 pages):
http://www.onderzoeksraad.nl/docs/rapporten/Rapport_TA_ENG_web.pdf
The automated control systems involved, by FAA law, are required
to be dual redundant, ultra reliable, life critical systems.
Prior to reading this I was under the impression that
"dual redundant system" mean something loosely similar to the
shuttle design... one component fails and others take over.
Subsystems comparing values and bring problems to human attention.
But that is not how these work.
In my opinion, it is appalling how badly designed these
system were in so many respects, from human ergonomics,
to architecture, design, to not testing failure modes.
Systems that don't talk to each other, or compare values,
or compare decisions, major automatic mode changes with
little indication to humans that it has occurred.
One subsystem tried to fly while another tried to land,
without this even being detected.
I draw interested parties attention to sections:
5.2 Technology
5.4.1 Peculiarities before the ILS approach
5.4.2 Peculiarities during the ILS approach
Appendix Q: Automatic flight system investigation
From the report:
"The aircraft involved in the accident was being flown by the
first officer, who was sitting on the right-hand side.
His primary flight display showed the readings measured by the
right radio altimeter system. The right-hand autopilot was in use and,
once air traffic control had provided a heading and altitude to be flown,
it was in the ‘altitude hold’ mode in order to maintain that altitude.
During the approach, the left radio altimeter system displayed an
incorrect height of -8 feet. This could be seen on the captain’s
(left-hand) primary flight display. The first officer’s (right-hand)
primary flight display, by contrast, indicated the correct height,
as provided by the right-hand system. The lefthand radio altimeter system,
however, categorised the erroneous altitude reading as a correct one,
and did not record any error. This is why there was no transfer to
the right-hand radio altimeter system. In turn, this meant that it
was the erroneous altitude reading that was used by various aircraft
systems, including the autothrottle. The crew were unaware of this,
and could not have known about it. The manuals for use during the flight
did not contain any procedures for errors in the radio altimeter system.
In addition, the training that the pilots had undergone did not include
any detailed system information that would have allowed them to
understand the significance of the problem
When the aircraft started to follow the glidepath (the ideal path to
the runway) because of the incorrect altitude reading, the autothrottle
moved into the ‘retard flare’ mode. This mode is normally only activated
in the final phase of the landing, below 27 feet. This was possible
because the other preconditions had also been met, including flaps
at (minimum) position 15. The thrust from both engines was accordingly
reduced to a minimum value (approach idle). This mode was shown on the
primary flight displays as ‘RETARD’. However, the right hand autopilot,
which was activated, was receiving the correct altitude from the
right-hand radio altimeter system. Thus the autopilot attempted to
keep the aircraft flying on the glide path for as long as possible.
This meant that the aircraft’s nose continued to rise, creating an
increasing angle of attack of the wings. This was necessary
in order to maintain the same lift as the airspeed reduced.
In the first instance, the pilots’ only indication that the
autothrottle would no longer maintain the pre-selected speed of
144 knots was the RETARD display. When the speed fell below this
value at a height of 750 feet, they would have been able to see
this on the airspeed indicator on the primary flight displays.
When subsequently, the airspeed reached 126 knots, the frame of the
airspeed indicator also changed colour and started to flash.
The artificial horizon also showed that the nose attitude of the
aircraft was becoming far too high. The cockpit crew did not respond
to these indications and warnings. The reduction in speed and excessively
high pitch attitude of the aircraft were not recognised until the approach
to stall warning (stick shaker) went off at an altitude of 460 feet.
This warning is activated shortly before the aircraft reaches a stall
situation. In a stall situation the wings of the aircraft are not
providing sufficient lift and the aircraft cannot fly anymore.
If the prescribed recovery procedure - i.e. selecting full engine power and
reducing the pitch attitude of the aircraft - is implemented correctly
and immediately when the stick shaker starts, then the aircraft will
continue to fly normally. Boeing’s procedures also prescribe that the
throttle levers should be pushed fully forward in such a case.
The first officer responded immediately to the stick shaker by pushing
the control column forward and also pushing the throttle levers forward.
The captain however, also responded to the stick shaker commencing by
taking over control. Assumingly the result of this was that the first
officer’s selection of thrust was interrupted. The result of this was
that the autothrottle, which was not yet switched off, immediately pulled
the throttle levers back again to the position where the engines
were not providing any significant thrust. Once the captain had taken
over control, the autothrottle was disconnected, but no thrust was
selected at that point. Nine seconds after the commencement of the first
approach to stall warning, the throttle levers were pushed fully forward,
but at that point the aircraft had already stalled and the height
remaining, of about 350 feet, was insufficientfor a recovery."
Eric